Information Governance (IG) Refresher Training 2011/2012

1. Information Governance (IG)Refresher Training 2011/2012 Completion of this training also requires that a quiz accompanying this presentation is completed and that a minimum of 9 from the 12 questions are answered correctly

2. Key Learning Points • What Information Governance is. • What YOU need to do to make this work. • Follow the Caldicott Guidelines • Provide a Confidential Service • Comply with the Law. • Understand the Data Protection Act Principles • Recognise a Freedom of Information Act request • Follow the Records Management NHS Code. • Keep Information Secure. • Input Quality Information.

3. What do YOU need to do to make this work? Information Governanceis the responsibility of EVERYONE in the organisation !

4. NHS IG Standards • After serious losses of personal information, including the loss in 2007 of computer disks containing the names, addresses and bank details of 25 million child benefit claimants, the Government conducted a Data Handling Review (June 2008). • This sets out mandatory measures for public bodies on protecting personal data such as staff training and committed the Government to publicly reporting progress on putting these measures into place.

5. NHS IG Standards • The first progress report of the UK Government’s Data Handling Review was published in January 2010 and noted the NHS progress in improving the following standards of information handling: • Performance management to push improvements. • Contracts with organisations being renegotiated to make sure confidentiality and security protections are in place. • Older computer systems being replaced with modern systems that have state of the art security. • Nearly one million encryption licences were in use under a nationally negotiated contract. • Encryption had been mandated for all patient data held on portable devices (e.g. memory sticks, laptops). • Online training was made available to over one million staff (e.g. IG training module). • The information governance framework and guidance had been further developed so that NHS organisations were clear about expected standards.

6. The NHS operating framework • The Department of Health (DH) published an ‘Operating Framework’ which set out objectives for the NHS key themes included: • Organisations must meet all Information Governance requirements set out by DH by 31st March each year (the level of compliance is then reported to DH and Care Quality Commission) • Ensuring that all staff receive annual basic Information Governance training (through the online NHS IG Training Tool, Face to Face or Accredited Learning Package). • Reporting on the management of information risks • Publishing security breaches in annual reports.

7. Confidentiality Personal Information Information about an individual is personal information when it enables an individual to be identified. It is non-personal when it doesn’t. This isn’t always straightforward, e.g. a person’s name and address are clearly personal information when presented together, but an unusual surname may itself enable someone to be identified. This is an important distinction in law. Sensitive Personal Information Personal information is legally classed as sensitive when it makes reference to particular matters of an identifiable person, such as his/her health, ethnicity, religion, criminal record or sexual life. These are also listed in the Data Protection Act 1998. Other details, e.g. a person’s bank account details, DNA or finger prints are not listed in the Data Protection Act 1998 but are still regarded as sensitive because of the damage and distress that could be caused if they were not properly protected. The rules set out in the Data Protection Act only apply to information about living individuals – not the deceased. This differs to the common law duty of confidentiality which continues after the death of the patient.

8. Confidentiality Confidential Information – Health & Staff Information Personal and sensitive personal information is classed as confidential if it was provided in circumstances where an individual could reasonably expect that it would be held in confidence, e.g. a healthcare professional and patient. This applies to staff working on behalf of the health professional such as pharmacy / dental and eyecare staff. Confidentiality is accepted to extend after the death of the patient or staff member. Personal or Sensitive Information CAN be Confidential Information Whether information is confidential or not depends on the circumstances under which it was provided. If it is: private information about a person AND given to someone who has a duty of confidence AND expected to be used in confidence THEN IT IS CONFIDENTIAL INFORMATION.

9. Disclosing information • Confidential information should not normally be used (which includes sharing and disclosing) unless one of the following criteria are met. • The person has given consent for the disclosure. • For patients: • Consent may be implied for care purposes and related purposes that support or check the quality of care provided. • For other purposes consent should be specifically sought. • 2. There is a legal basis which permits or requires disclosure of confidential information. • 3. There are exceptional circumstances (e.g. investigation or prevention of serious crime) where the overriding public interest outweighs the duty of confidentiality.

10. Caldicott guardian • In 1997 a review was carried out into the use of patient identifiable information in the NHS. This was carried out because there were concerns about how patient information was being handled and transferred. • Dame Fiona Caldicott chaired the ‘Caldicott Review’. The report set out principles and recommendations for the security of patient information. • An important recommendation was that a senior clinician should be nominated in each NHS Trust to act as the Trust’s conscience for the uses of patient identifiable information. These senior clinicians are known as ‘Caldicott Guardians’. • The Caldicott Guardian for CDDFT Dr Robin Mitchell. • In independent contractor organisations such as General Practice, Pharmacy, Dental Practice and Eye Care Services a person, normally the practice manager, will act as the ‘Information Governance Lead’ and coordinate Information Governance issues including the Caldicott principles and recommendations.

11. Six Caldicott principles The six Caldicott principles support the confidentiality and security controls on using patient information. The principles should be used whenever a use of confidential information is being considered and in particular when there is an intention to transfer confidential information to another organisation: Justify the purpose for using confidential information. Only use it when absolutely necessary. Use the minimum required. Access should be on a strict need-to-know basis. Everyone must understand their responsibilities. Everyone must understand and comply with the law.

12. NHS care record guarantee • The National Information Governance Board is a statutory body which champions the confidentiality and security of health and social care services records, especially records containing clinical and care information. • The Board published the NHS Care Record Guarantee in 2005. The Guarantee sets out rules that govern how patient information is used in the NHS. • This includes: • people’s access to their own records • controls; monitoring and policing staff access to patient files • options that patients have to limit access • access in an emergency • what happens when someone cannot make decisions for themselves.

13. Data Protection Act 1998 UK law in the form of the Data Protection Act 1998 governs how organisations may use personal information (about living people), including how they acquire, store, share or dispose of it. The Information Commissioners Office (ICO) is the UK’s independent regulator set up to uphold the public’s information rights by promoting data privacy for individuals (and openness by public bodies). The ICO investigates complaints made by the public and provides guidance for the public and organisations. Under the Act, organisations that process personal information must notify the ICO (unless they are exempt). The organisations’ details are entered on a public register (available on the internet). Failure to notify is a criminal offence. The CDDFT Data Protection Officer / Data Controler for is LISA WILSON

14. COMPLY WITH THE LAW Data Protection Act 1998 – It is your responsibility to understand the principles in relation to your role and the organisation. • The Data Protection Principles - Personal data must be: • Processed fairly and lawfully • Processed for specified purposes • Adequate, relevant and not excessive • Accurate and up-to-date • Not kept for longer than necessary • Processed in accordance with the rights of data subjects • Protected by appropriate security (practical and organisational) • Not transferred outside the EEA without adequate protection

15. FREEDOM OF INFORMATION ACT Public Authorities (including NHS Trusts, Local Authorities, Dentists, Doctors, Eye Care Services and Pharmacists), are subject to the legal obligations of the Freedom of Information (FOI) Act 2000. Public Authorities have only 20 working days to respond to written information requests. This is the limit set out by law. Speak to your Line Manager if you are unsure about your organisation’s procedure for dealing with FOI requests. The Information Commissioners Office (ICO) is the independent regulator set up to uphold people’s information rights by promoting openness for public bodies. The CDDFT Freedom of Information Officer is JOANNA TYRELL (nee JENKINS)

16. NHs Constitution The NHS Constitution was first published on 21 January 2009 and was updated after public consultation in March 2010. It describes the principles of the NHS in England and the rights and responsibilities of patients, public and staff. One such right is that patients can expect the NHS to keep their confidential information safe and secure. All NHS bodies and private and third sector providers supplying NHS services are required by law to take account of the NHS Constitution in their decisions and actions. The NHS Constitution will be renewed every ten years.

17. HANDLING INFORMATION Holding it securely and confidentially Obtaining it fairly and efficiently Recording it accurately and reliably Using it effectively and ethically Sharing it appropriately and lawfully

18. CDDFT - Key Information Governance Staff Caldicott Guardian Dr Robin Mitchell Senior Information Risk Owner – Sue Jacques (Chief Operating Officer & Director of Finance)

19. If you are not sure or in doubt, don’t disclose. Immediately seek further advice from your Line Manager or The Caldicott Guardian

20. CDDFT - Key Information Governance Staff Data Protection Officer Lisa Wilson (Head of Information Governance & IT Security) Freedom of Information Lead Joanna Tyrell (nee Jenkins)

21. Follow the Records ManagementNHS Code of Practice Best Practice Guidance States: All Staff have a legal and professional obligation to be responsible for any records which they create or use in the performance of their duties. Any record created by an individual, up to the end of its retention period, is a public record and subject to Information requests (FOI, DPA and Subject Access).

22. Input Quality Information Right information, Right place, Right time Accuracy is just one quality that we expect in records. But other qualities are also needed for the information to be useful, e.g. it would be pointless having information which was 100% accurate but wasn’t available in time for it to be used. Information is used to make decisions throughout the health sector each day in all sorts of situations. Sometimes this information needs to be extremely high quality, such as quick and accurate test results to help decide a patient’s urgent condition and treatment. Other information may be less urgent or the level of accuracy may be less vital, such as an annual national comparison of ‘flu injections for forward planning. Whatever the situation, the right information should be in the right place at the right time - and that needs to be achieved every time. Poor quality information Poor quality information is bad for patient care, bad for funding and bad for reputation, e.g. Incomplete, inadequately analysed data can lead to serious failures in service. Poor demographic data results in duplicate and confused entries on patient record systems. Confused patient identity numbers can lead to the wrong patient being treated. Inadequate records lead to poorly planned care. Poor data results in poor commissioning, monitoring, planning and financing of services.

23. Input Quality Information High quality information The NHS takes Information Quality very seriously because the consequences can be vital to patient outcomes or, in the case of planning, result in too much or not enough service provision. High quality means: Complete Accurate Relevant Accessible Timely

24. DON’T SHARE YOUR SMARTCARD OR PASSWORD “Can I borrow your Credit Card & PIN number?” “Of course you can!” Could you imagine having this conversation with a colleague?

25. BE AWARE

26. Security breaches • Major causes of breaches include • Information disclosed in error • Lost data/hardware • Information lost in transit • Stolen data or hardware • A technical or procedural failure • Breach arising from non-secure disposal

27. Keep Information Secure Follow Organisation Policies Protect Information Physically Practice Password Management Transfer Information Securely Report Breaches of Security to Management It is your responsibility to keep all personal & sensitive information secure